From 01b4d22b5cf7a1cb2275bc1fb5199b68b10aa8de Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 11 Oct 2026 10:48:39 +0000
Subject: [PATCH] Bump rand from 0.8.8 to 0.9.5

Bumps [rand](https://github.com/rust-random/rand) from 0.8.8 to 0.9.5.
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/0.9.5/CHANGELOG.md)
- [Commits](https://github.com/rust-random/rand/compare/0.8.8...0.9.5)

---
updated-dependencies:
- dependency-name: rand
  dependency-version: 0.9.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Cargo.lock        | 46 ++++++++--------------------------------------
 cli/Cargo.toml    |  2 +-
 engine/Cargo.toml |  2 +-
 server/Cargo.toml |  2 +-
 4 files changed, 11 insertions(+), 41 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 2b79c70..3ec160d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3249,35 +3249,14 @@ version = "6.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
-[[package]]
-name = "rand"
-version = "0.8.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e058c7de0b26af77780c769414d6257830bb240f3c38477dbc2c16e5f54d6d4c"
-dependencies = [
- "libc",
- "rand_chacha 0.3.1",
- "rand_core 0.6.4",
-]
-
 [[package]]
 name = "rand"
 version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
 dependencies = [
- "rand_chacha 0.9.0",
- "rand_core 0.9.5",
-]
-
-[[package]]
-name = "rand_chacha"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
-dependencies = [
- "ppv-lite86",
- "rand_core 0.6.4",
+ "rand_chacha",
+ "rand_core",
 ]
 
 [[package]]
@@ -3287,16 +3266,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
 dependencies = [
  "ppv-lite86",
- "rand_core 0.9.5",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
-dependencies = [
- "getrandom 0.2.17",
+ "rand_core",
 ]
 
 [[package]]
@@ -3982,7 +3952,7 @@ version = "1.0.0"
 dependencies = [
  "clap",
  "futures-util",
- "rand 0.8.8",
+ "rand",
  "reqwest 0.12.28",
  "serde",
  "serde_json",
@@ -4005,7 +3975,7 @@ dependencies = [
  "hyper-util",
  "keyring",
  "md-5",
- "rand 0.8.8",
+ "rand",
  "regex",
  "reqwest 0.12.28",
  "serde",
@@ -4026,7 +3996,7 @@ dependencies = [
  "futures-util",
  "hyper",
  "hyper-util",
- "rand 0.8.8",
+ "rand",
  "reqwest 0.12.28",
  "serde",
  "serde_json",
@@ -5127,7 +5097,7 @@ dependencies = [
  "http",
  "httparse",
  "log",
- "rand 0.9.5",
+ "rand",
  "sha1",
  "thiserror 2.0.20",
  "utf-8",
@@ -5145,7 +5115,7 @@ dependencies = [
  "httparse",
  "log",
  "native-tls",
- "rand 0.9.5",
+ "rand",
  "sha1",
  "thiserror 2.0.20",
 ]
diff --git a/cli/Cargo.toml b/cli/Cargo.toml
index 5264a34..98caeb4 100644
--- a/cli/Cargo.toml
+++ b/cli/Cargo.toml
@@ -20,7 +20,7 @@ tokio = { workspace = true, features = ["io-std", "signal"] }
 clap = { version = "4", features = ["derive", "env"] }
 # Runs on a server (--server): POST /api/run, read as lines; reports from /api/files.
 reqwest = { version = "0.12", features = ["json"] }
-rand = "0.8"
+rand = "0.9"
 
 [build-dependencies]
 # The interface's dictionaries are read at build time (src/lib/locales/*.ts).
diff --git a/engine/Cargo.toml b/engine/Cargo.toml
index 700a3b8..0bdfdc0 100644
--- a/engine/Cargo.toml
+++ b/engine/Cargo.toml
@@ -20,7 +20,7 @@ cookie_store = "0.22"
 base64 = "0.22"
 md-5 = "0.10"
 sha2 = "0.10"
-rand = "0.8"
+rand = "0.9"
 # Extract by pattern and the "matches" comparison in experiments.
 regex = "1"
 # Socket options tokio doesn't expose before bind — SO_REUSEADDR, so the
diff --git a/server/Cargo.toml b/server/Cargo.toml
index 9d444bd..c34132f 100644
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -26,7 +26,7 @@ hyper = { version = "1", features = ["server", "http1"] }
 hyper-util = { version = "0.1", features = ["tokio", "service"] }
 tower = { version = "0.5", features = ["util"] }
 clap = { version = "4", features = ["derive", "env"] }
-rand = "0.8"
+rand = "0.9"
 reqwest = { version = "0.12", default-features = false }
 # The body of a followed run (/api/run), written as the run goes.
 futures-util = "0.3"